NginxProxyManager / NginxProxyManager/nginx-proxy-manager
[Feature Request] Allow issuing different key sizes, setting default key sizes for both RSA and ECDSA, allowing use of more than one certificate per proxy_host
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34.2k
- Forks
- 3.9k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 20
Description
Is your feature request related to a problem? Please describe.
Let's Encrypt supports RSA keys between 2048 and 4096, and ECDSA P-256 and P384
Describe the solution you'd like
In the Certificates menu tab, when requesting a certificate from there, allow the following key sizes:
- RSA 2048
- RSA 3072
- RSA 4096
- ECDSA 256
- ECDSA 384
Could also be beneficial to have a settable "default key size" and mirror the same dropdown.
Default RSA Key Size: (2048, 3072, 4096)
Default ECDSA Key Size: (256, 384)
The certbot arguments are as follows:
--key-type ecdsa --elliptic-curve secp256r1
--key-type ecdsa --elliptic-curve secp384r1
--key-type rsa --rsa-key-size 2048
--key-type rsa --rsa-key-size 3072
--key-type rsa --rsa-key-size 4096
Another consideration: to support the maximum number of ciphers possible, modern versions of Nginx support multiple ssl_certificate and ssl_certificate_key directives. When configuring a standard nginx instance, the following would prioritize ECDSA, but allow RSA fallback, and show both available for negotiation through a service like ssllabs or the testssl.sh project:
ssl_certificate /path/to/ecdsa.crt;
ssl_certificate_key /path/to/ecdsa.key;
ssl_certificate /path/to/rsa.crt;
ssl_certificate_key /path/to/rsa.key;
The request for the above is to allow either issuing 2 certificates at proxy creation time, or creating the certificates through the certificate tab, and be able to link both of them to any given proxy host. a quick check of the public key could then inform the order of the ssl_certificate/ssl_certificate_key statements in the proxy host configurations.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the Certificates menu and the proxy host configuration flow, then trace how certificate requests pass the listed Certbot options and how Nginx certificate directives are generated. Done should include the requested RSA and ECDSA choices, configurable defaults, and support for associating multiple certificates with one proxy host.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx, typescript
- Domain
- backend, frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100